{
  "title": "Candidate vulnerability report",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "status": {"type": "string", "enum": ["candidates", "no_findings", "blocked"]},
    "scope": {"type": "string", "minLength": 1},
    "findings": {
      "type": "array",
      "maxItems": 50,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "id": {"type": "string", "minLength": 1},
          "severity": {"type": "string", "enum": ["critical", "high", "medium", "low", "informational"]},
          "location": {"type": "string", "minLength": 1},
          "preconditions": {"type": "string", "minLength": 1},
          "evidence": {"type": "string", "minLength": 1},
          "impact": {"type": "string", "minLength": 1},
          "falsification_or_reproduction": {"type": "string", "minLength": 1},
          "confidence": {"type": "string", "enum": ["low", "medium", "high"]},
          "empirically_confirmed": {"const": false}
        },
        "required": ["id", "severity", "location", "preconditions", "evidence", "impact", "falsification_or_reproduction", "confidence", "empirically_confirmed"]
      }
    },
    "tested_negative_controls": {"type": "array", "items": {"type": "string"}, "maxItems": 30},
    "limitations": {"type": "array", "items": {"type": "string"}, "maxItems": 30}
  },
  "required": ["status", "scope", "findings", "tested_negative_controls", "limitations"],
  "allOf": [
    {
      "if": {"properties": {"status": {"const": "candidates"}}, "required": ["status"]},
      "then": {"properties": {"findings": {"minItems": 1}}}
    },
    {
      "if": {"properties": {"status": {"const": "no_findings"}}, "required": ["status"]},
      "then": {"properties": {"findings": {"maxItems": 0}, "tested_negative_controls": {"minItems": 1}}}
    },
    {
      "if": {"properties": {"status": {"const": "blocked"}}, "required": ["status"]},
      "then": {"properties": {"limitations": {"minItems": 1}}}
    }
  ]
}